What does "Retention" in risk management mean?

"Retention" in risk management refers to the practice of accepting risks and the associated consequences rather than transferring those risks to another entity, avoiding them, or attempting to reduce their impact. This notion of retention indicates that an individual or organization acknowledges the existence of a risk and decides to bear the financial consequences if that risk materializes.

Retention can be a strategic choice, especially when the cost of transferring the risk (for instance, through insurance) is greater than the potential loss from the risk itself. Organizations may retain risks that are low in frequency and severity, meaning that while the risk exists, they determine that they are equipped to handle any resulting losses or damages themselves.

The other options describe different risk management strategies. For example, passing risks to another party is known as risk transfer, typically involving insurance policies. Avoiding risks completely involves actions that eliminate any possibility of the risk occurring, and reducing the impact of risks pertains to risk mitigation strategies designed to lessen the effects should the risk occur. In contrast, retention is characterized by a willingness to accept the risk and manage it directly.